In Figure REF  (e)(f), we demonstrate the generality of our method. Watermarking algorithm should be independent of the dataset and the ML algorithms. In sub-figure (e), a different dataset is used to probe the suspect model. To be specific, we select the second half of the training data as the probing dataset, rather than the first half used in previous experiments. The results imply that DRW turns out to work well when we use unseen data to produce the probing dataset for the suspect model. In sub-figure (f), we choose a different backbone RoBERTa [1]} for the suspect model, in which the victim model continues to be the BERT model. The high peak in the power spectrum at frequency \(f_w\)  reveals that DRW is still able to detect the signal.
